This update for qemu fixes several issues. These security issues were fixed: - CVE-2017-15268: Qemu allowed remote attackers to cause a memory leak by triggering slow data-channel read operations, related to io/channel-websock.c . - CVE-2017-9524: The qemu-nbd server when built with the Network Block Device Server support allowed remote attackers to cause a denial of service by leveraging failure to ensure that all initialization occurs talking to a client in the nbd_negotiate function . - CVE-2017-15289: The mode4and5 write functions allowed local OS guest privileged users to cause a denial of service via vectors related to dst calculation - CVE-2017-15038: Race condition in the v9fs_xattrwalk function local guest OS users to obtain sensitive information from host heap memory via vectors related to reading extended attributes - CVE-2017-10911: The make_response function in the Linux kernel allowed guest OS users to obtain sensitive information from host OS kernel memory by leveraging the copying of uninitialized padding fields in Xen block-interface response structures - CVE-2017-12809: The IDE disk and CD/DVD-ROM Emulator support allowed local guest OS privileged users to cause a denial of service by flushing an empty CDROM device drive - CVE-2017-10664: qemu-nbd did not ignore SIGPIPE, which allowed remote attackers to cause a denial of service by disconnecting during a server-to-client reply attempt - CVE-2017-10806: Stack-based buffer overflow allowed local guest OS users to cause a denial of service via vectors related to logging debug messages - CVE-2017-14167: Integer overflow in the load_multiboot function allowed local guest OS users to execute arbitrary code on the host via crafted multiboot header address values, which trigger an out-of-bounds write - CVE-2017-11434: The dhcp_decode function in slirp/bootp.c allowed local guest OS users to cause a denial of service via a crafted DHCP options string - CVE-2017-11334: The address_space_write_continue function allowed local guest OS privileged users to cause a denial of service by leveraging use of qemu_map_ram_ptr to access guest ram block area - CVE-2017-13672: The VGA display emulator support allowed local guest OS privileged users to cause a denial of service via vectors involving display update These non-security issues were fixed: - Fixed not being able to build from rpm sources due to undefined macro - Fixed wrong permissions for kvm_stat.1 file - Fixed KVM lun resize not working as expected on SLES12 SP2 HV